Analysis
- max time kernel
135s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 02:23
General
- Target 113bf76ec9ccab391fc67b37796c6585_JaffaCakes118.rtf
- Size 101KB
- Sample240504-cvdjjsdh35
- SHA256 7e6617004fab3e3abd5b09d9eecf547b324459d9b333f4bd68be340f8e9c68e3
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\113bf76ec9ccab391fc67b37796c6585_JaffaCakes118.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
memory/5096-5-0x00007FF93D0AD000-0x00007FF93D0AE000-memory.dmp
memory/5096-13-0x00007FF8FA920000-0x00007FF8FA930000-memory.dmp
memory/5096-4-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-3-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-0-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-9-0x00007FF93D010000-0x00007FF93D205000-memory.dmp
memory/5096-8-0x00007FF93D010000-0x00007FF93D205000-memory.dmp
memory/5096-7-0x00007FF93D010000-0x00007FF93D205000-memory.dmp
memory/5096-6-0x00007FF93D010000-0x00007FF93D205000-memory.dmp
memory/5096-10-0x00007FF93D010000-0x00007FF93D205000-memory.dmp
memory/5096-1-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-11-0x00007FF93D010000-0x00007FF93D205000-memory.dmp
memory/5096-12-0x00007FF93D010000-0x00007FF93D205000-memory.dmp
memory/5096-14-0x00007FF8FA920000-0x00007FF8FA930000-memory.dmp
memory/5096-2-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-510-0x00007FF93D010000-0x00007FF93D205000-memory.dmp
memory/5096-535-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-536-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-537-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-534-0x00007FF8FD090000-0x00007FF8FD0A0000-memory.dmp
memory/5096-538-0x00007FF93D010000-0x00007FF93D205000-memory.dmp